{"action":"created","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/1769","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/1769/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/1769/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/1769/events","html_url":"https://github.com/mholt/caddy/issues/1769","id":243314969,"number":1769,"title":"Log Privacy","user":{"login":"myReaper","id":5735944,"avatar_url":"https://avatars0.githubusercontent.com/u/5735944?v=4","gravatar_id":"","url":"https://api.github.com/users/myReaper","html_url":"https://github.com/myReaper","followers_url":"https://api.github.com/users/myReaper/followers","following_url":"https://api.github.com/users/myReaper/following{/other_user}","gists_url":"https://api.github.com/users/myReaper/gists{/gist_id}","starred_url":"https://api.github.com/users/myReaper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myReaper/subscriptions","organizations_url":"https://api.github.com/users/myReaper/orgs","repos_url":"https://api.github.com/users/myReaper/repos","events_url":"https://api.github.com/users/myReaper/events{/privacy}","received_events_url":"https://api.github.com/users/myReaper/received_events","type":"User","site_admin":false},"labels":[{"id":204890680,"url":"https://api.github.com/repos/mholt/caddy/labels/feature%20request","name":"feature request","color":"c7def8","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2017-07-17T07:31:34Z","updated_at":"2017-08-29T07:33:38Z","closed_at":null,"body":"Hi,\r\n\r\ni just add this directly as \"feature request\" as I can't find any option for this in the documentation :-)\r\n\r\nFor privacy reasons it is crucial to strip the last or the last two octets of an IP address in the access.log . I'm currently using the \"{combined}\" format to log my websites and can't find any option in the documentation to strip them.\r\n\r\nI think this is also mandatory for many caddy users because of privacy regulations in many countries.\r\n\r\nBest Regards"},"comment":{"url":"https://api.github.com/repos/mholt/caddy/issues/comments/325579978","html_url":"https://github.com/mholt/caddy/issues/1769#issuecomment-325579978","issue_url":"https://api.github.com/repos/mholt/caddy/issues/1769","id":325579978,"user":{"login":"dmke","id":327411,"avatar_url":"https://avatars1.githubusercontent.com/u/327411?v=4","gravatar_id":"","url":"https://api.github.com/users/dmke","html_url":"https://github.com/dmke","followers_url":"https://api.github.com/users/dmke/followers","following_url":"https://api.github.com/users/dmke/following{/other_user}","gists_url":"https://api.github.com/users/dmke/gists{/gist_id}","starred_url":"https://api.github.com/users/dmke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmke/subscriptions","organizations_url":"https://api.github.com/users/dmke/orgs","repos_url":"https://api.github.com/users/dmke/repos","events_url":"https://api.github.com/users/dmke/events{/privacy}","received_events_url":"https://api.github.com/users/dmke/received_events","type":"User","site_admin":false},"created_at":"2017-08-29T07:33:38Z","updated_at":"2017-08-29T07:33:38Z","body":"The current law in Germany (as the [GDPR](https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation) is still half a year waey) 7is the \"[Bundesdatenschutzgesetz](https://www.gesetze-im-internet.de/bdsg_1990/index.html)\" (BSDG, Federal Data Privacy Law). The exact paragraph is hard to determine, since it runs under the category of a \"Verbotsgesetz\" (meaning it is forbidden to process personal/identifying data, unless you've got permission from the data owner to do so). The law itself defines exceptions from these limitations, [§ 1 Zweck und Anwendungsbereich des Gesetzes](https://www.gesetze-im-internet.de/bdsg_1990/__1.html) (purpose and application of the law):\r\n\r\n> (1) Zweck dieses Gesetzes ist es, den Einzelnen davor zu schützen, dass er durch den Umgang mit seinen personenbezogenen Daten in seinem Persönlichkeitsrecht beeinträchtigt wird.\r\n> (2) Dieses Gesetz gilt für die Erhebung, Verarbeitung und Nutzung personenbezogener Daten durch\r\n> 1. öffentliche Stellen des Bundes,\r\n> 2. öffentliche Stellen der Länder, […],\r\n> 3. nicht-öffentliche Stellen, soweit sie die Daten unter Einsatz von Datenverarbeitungsanlagen verarbeiten, nutzen oder dafür erheben oder die Daten in oder aus nicht automatisierten Dateien verarbeiten, nutzen oder dafür erheben, es sei denn, die Erhebung, Verarbeitung oder Nutzung der Daten erfolgt ausschließlich für persönliche oder familiäre Tätigkeiten.\r\n> […]\r\n\r\nThis roughly translates to (IANAL and not a native english speaker):\r\n\r\n> (1) Purpose of this law is to protect the individual from impairments of their personal rights when handling individual-related data.\r\n> (2) This law regulate the inception, processing and use of individual-related data from\r\n> 1. public authorities at federal level,\r\n> 2. public authorities at non-federal level, […],\r\n> 3. non-public bodies, if they process, use or collect data via data processing facilities, or if they use or collect non-automated data, unless the collection, processing or usage is only for personal or familial purposes.\r\n> […]\r\n\r\n(Background: the German Supreme Court has declared data privacy a constitutional right in the 1980s.)\r\n\r\nNow, to the fact whether or not an IP address is a person-identifying date: There are AFAIK no court decisions or clear statements in the law. However, the general consensus is, that an IP address on its own does not identify a person (and, by implication, collection and usage is fine), **but** the moment you are able to reference the address (either by jurisdictional or technical means) with other identifying data, such as name or email address, the IP address becomes an identifying date.\r\n\r\nAn ISP for example can perform a database lookup to get name, address, ... to an IP address, thus the ISP needs a special agreement with its customers (you'll find such a clause in the contracts).\r\n\r\nA personal homepage owner on the other hand might be fine to log all IP addresses (unobfuscated), as far as he/she only serves static pages (i.e. no user login when proxying to an application server, wiki, forum, ...). If the personal homepage contains a contact form, the user must be informed about data processing (including the exact data points processed), even if this is just a simple email forwarder. The moment a user submits the form, the owner can associate the information entered via its timestamp with her/his logs, and the IP address becomes person-identifyable."}}
{"actor":{"display_login":"dmke"}}